af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe
Size

73KB
MD5

0e59e737be570021bc7444ccae46b044
SHA1

2250ac81047c1953f6b71305e6f2532f0a57a793
SHA256

af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e
SHA512

2365ec1121a47cc3504850327716954c2f9caec500211d50f300866446cd54c2c9825bc307dabd124dbbd1465addc1e39f351b26cd80396dd5a753206f2f7f5b
SSDEEP

768:PVofFEdN379p4GBSgkEVQWZEARrLmSeWQfB/2ieWQfB/2peWQfB/23eWQfB/2hGa:dsaN37X4GpkECVwLzKNrKNsKNaKNUX1r

Score

1^/10

Malware Config

Signatures

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe
Token: SeDebugPrivilege	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe
1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1520	984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	27
PID 984 wrote to memory of 1520	984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	27
PID 984 wrote to memory of 1520	984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	27
PID 984 wrote to memory of 1520	984	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	27
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28
PID 1520 wrote to memory of 2044	1520	af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe	28

C:\Users\Admin\AppData\Local\Temp\af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe
"C:\Users\Admin\AppData\Local\Temp\af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:984
- C:\ProgramData\pcdfdata\af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe
  C:\ProgramData\pcdfdata\af138ce98aecab05b55694a9d1528c6c7da75316c4123353f2cf1081c869449e.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/984-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/984-58-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/984-57-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/984-60-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1520-55-0x0000000000000000-mapping.dmp

Download
memory/1520-59-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/1520-61-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads